Skip to main content
Mallory
Back to intelligence
internet-facing-service-vulnerabilitywidely-deployed-product-advisorydefense-evasion-method

Apache Tomcat Patches for URL Rewrite Bypass and Console Injection Vulnerabilities

Updated 2mo agoFirst seen Oct 28, 20253 sources

Apache Tomcat released security updates addressing two critical vulnerabilities: a URL rewrite bypass (CVE-2025-55752) that could allow directory traversal and potential remote code execution (RCE) if the HTTP PUT method is enabled, and a console ANSI injection flaw (CVE-2025-55754) that could enable manipulation of log messages via escape sequences. The affected versions include Tomcat 11.0.0-M1 to 11.0.10, 10.1.0-M1 to 10.1.44, and 9.0.0.M11 to 9.0.108, with users and administrators urged to apply the necessary patches immediately to mitigate risk.

The URL rewrite bypass vulnerability allows attackers to craft malicious requests that evade security controls, potentially leading to unauthorized file access or code execution on vulnerable servers. The console ANSI injection issue could be exploited to alter log output, possibly obscuring malicious activity or facilitating further attacks. Security advisories from both Apache and national cybersecurity authorities emphasize the importance of prompt remediation to prevent exploitation in the wild.

Share:
Apache Tomcat Patches for URL Rewrite Bypass and Console Injection Vulnerabilities
Stay ahead

Get ahead of threats like this

Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.

Start free trial
EVENT TIMELINE

How this story unfolded

1 event from the most recent confirmed update back to the earliest known activity.

1 EVENTS
Oct 27, 20257mo ago

Apache releases Tomcat advisories for CVE-2025-55752 and CVE-2025-55754

On 2025-10-27, Apache published security advisories for multiple Apache Tomcat versions covering CVE-2025-55752, a rewrite-based directory traversal issue that could lead to RCE if PUT is enabled, and CVE-2025-55754, a console escape-sequence injection flaw in log messages. The advisories instructed users and administrators to review affected versions and apply updates.

LINKED ENTITIES

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

4 LINKEDOpen in app
Vulnerabilities
2 linked
ANSI escape sequence injection in Apache Tomcat log messagesRelative Path Traversal in Apache Tomcat Rewrite Processing
Organizations
2 linked
Apache Software FoundationThe Cyber Centre
SOURCE COVERAGE

Sources

3 references tracked. Mallory keeps watching after this page renders.

3 SOURCESView all
The operational view lives in Mallory

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t — which of your assets are affected, which threat actors are using it right now, which detections to deploy, and what to do next.
Start free trial
Exposure mapping

Map indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidence

Every observed campaign, victim, and pivot linked to actors named in this story.

Associated malware

Malware, exploits, and IOCs connected to the activity described here.

Detection signatures

YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alerts

Get matching new stories delivered to your team as they break — not the next morning.

AI threads

Ask questions about this story and take action on the answers.

Apache Tomcat Patches for URL Rewrite Bypass and Console Injection Vulnerabilities | Mallory